CENTRUS ENERGY CORP

Managing cybersecurity risk is critical to Centrus. Centrus expects that the complexity of cybersecurity incidents will continue to evolve. To assess the changing cyber environment, Centrus includes the evaluation of cybersecurity risk as part of its enterprise risk management process and provides periodic reporting to the Board. Assessed risks, whether general or specific to the Company, include operational risk, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. This process includes evaluating risks from cybersecurity threats associated with the Company’s use ofthird-party service providers.

To evaluate the sufficiency of Centrus’ cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework. We periodically (i) have external experts complete assessments of Centrus’ cybersecurity posture, (ii) complete internal self-assessments and (iii) engage with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.

Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company’s business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.

Governance

Centrus has policies, procedures, and strategies in place to assist in assessing and managing cybersecurity risks. To help safeguard the Company’s network and information maintained on that network, the Company maintains and executes a cybersecurity program designed to monitor, prevent, detect, mitigate, and remediate cyberattacks.

The Board exercises its oversight of material risks from cybersecurity threats through the Board’s newly established Cyber Risk Committee. Per its charter, the Board’s Cyber Risk Committee oversees the Company’s cybersecurity policies, procedures, and plans, including the quality and effectiveness of the related security, confidentiality, availability, recoverability, integrity, and disaster or incident response programs. It coordinates with the Audit and Finance Committee and the Board’s Technology, Competition and Regulatory Committee on cross disciplinary issues such as cybersecurity.

The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to management’s Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. Management’s Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company’s cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company’s cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company’s efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company’s processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by management’s Cybersecurity Risk Committee, with material issues raised with our Board.